From the article: "Microsoft hasn’t bothered to fix it because Microsoft Authenticator is a free product and therefore doesn’t generate revenue."

It’s actually worse than that. Given the opportunity to escape, I’m sure many would pay to to allowed to do so.

Entering multi factor hell just to get into Teams is something I’d happily pay to avoid.

Assuming you use Microsoft Entra ("Azure Active Directory" as was), get your employer to enable the "preview" support for Security Keys. Why is it off by default? Well it's actually secure, and it would never do to provide a feature out of the box that actually works without lots of fiddling about, this is Microsoft, the consultant's friend.

These seem to be relatively current instructions: https://learn.microsoft.com/en-us/entra/identity/authenticat...

Having found a friendly sysadmin to do this, ask them to specifically not "Enforce key restrictions" which is theory could let your empoloyer require employees to use a specific issued authenticator credential - are they going to buy every employee an authenticator from a named brand? No? Then this must not be switched on, easy.

Once this feature is enabled for you (you may be able to get them to switch it on for the whole org, or maybe for IT or whatever department you work in) you should be able to enrol a new Security Key the same way you'd add other MFA.

So why go to all this bother? Because you can buy a Security Key that works how you want, a physical piece of hardware you own and can re-use - if you buy say the Yubico Security Key 2 in USB A, that goes in your USB A port on the laptop or dock and it just stays there. Its job is to be "Something you have" and the "Something you know" will be a PIN of your choosing (it literally doesn't leave your device, so corporate can't decide it should be the Password Game on steroids)

No need for a phone or other unrelated device, no opening fiddly apps, no transcribing codes, you type your PIN and touch the sensor. If a PIN is too much, some pricier options take fingerprints, so then you just touch the sensor (with the correct finger)

Thank you.

Security keys don't work with android phones when you want to logon to m365 email. This is a showstopper for a lot of people.

I moved the usb-c yubikey in my laptop to my Android phone and was able to login to my m365 calendar/mail/teams there, so it does work, as long as IT supports it.

Or enable the option to use any standard TOTP authenticator.

> goes in your USB A port on the laptop or dock and it just stays there

If it's always there, then why isn't it just a file on the disk? Why should I need to buy a new piece of hardware and permanently sacrifice one of my USB ports. Client certs have been the "something you own" for decades and the main problem with them was that using them didn't involve any JavaScript, which is blasphemy in modern web dev and so they were killed (with the help of EU bureaucrats). And now that basically every computer has a TPM, you can even satisfy the "not extractable" requirement, which was the only actual advantage of a yubikey.

That's what passkeys are.

> why isn't it just a file on the disk?

Because if done properly it can't be trivially cloned.

Hermione Granger would say: What an idiot!

Only almost all and increasing number of their revenue producing product depends on this being reliable, or at least have no bad reputation being unreliable. As the reputation is what many corporate ballonheads only care about. Still, hurt that too in their incompetent bencounter singlemindedness.

> Is no-one at Microsoft actually using their own Authenticator?

At most, I'd expect people to only use it for work, where Microsoft is the only issuer.

I also expect lots and lots of people to not use it.

> Unless I'm missing something, this would make it nearly unusable for almost all applications - as soon as you've used your email for one site you wouldn't be able to add it for any others?

Yeah, something is not making sense here. I've got multiple accounts with the same email and just compared the codes from Authenticator, which is my backup TOTP app, with the correct codes and Authenticator agreed.

I did find a UI problem that could lead to a user getting the wrong code. When the first few accounts are on the screen and it is time to refresh the codes the ones on screen refresh every 30 seconds.

The ones offscreen do not. When I scroll to bring offscreen codes into view they show an older code. In one case the code that scrolled in was 4 codes behind the correct code.

I've scanned two Facebook codes in sequence, the second Facebook code overwrote the first. Maybe that is the issue.

Along the same grain, Google, the search powerhouse, releases Google Authenticator with no search bar in the Android version. And continues to wilfully not include one despite multiple feature requests.

Yet there's a search bar in the iOS version. Just why?

I'm willing to bet that in that gigantic Piper repo, there's already a local search library that they could just drop in in a single CL. But that's not LLM.

When I bought a new phone and moved all my stuff over from a backup of my original phone, apparently the Google Authenticator doesn’t back something up.

When I launched GA all of my 2FA data was gone.

Thankfully I had my backup codes. And I could also still use the old one on the old phone. But the nightmare potential is quite high.

For a long time GA had no method to back up or extract the data. It also excluded itself from ADB backups. One had to root their phone to extract the data.

Aegis [1] seems to be a great alternative, at least on Android. Besides a search bar, it allows you to backup or export all your entries in an ecrypted vault. You can also include them in the Android cloud backups.

[1] https://github.com/beemdevelopment/Aegis

An alternative in sitautions where OTP-only is allowed. E.g. I work as a freelance contractor and every single customer requires MFA with GPS tracking. Some also require accessing Bluetooth on the phone.

Google authenticator is absolutely horrible. Until recently there was just no way to back it up, at all. If you were getting rid of your phone, well, tough shit.

You just need to export it using QR codes. My keys were paginated into 11 QR codes when transferring devices.

They now have cloud sync, which I don't really think is a good idea. But it solves your problem of migrating devices. However I've already moved on to Aegis, because I'm done fling scrolling through my Mahabharata of TOTPs to find the correct account.

> apparently the Google Authenticator doesn’t back something up.

This is widely known and IMO a very good argument to use a different TOTP/2FA app than Google Authenticator. There's plenty out.

Personally I use Bitwarden pro, which lets you add TOTP keys directly to the account you're using it for, integrating it into the login-process. Very smooth.

And it sync/backs up across all my devices.

One could say you shouldn't store the 2FA along with your password.

But 2FA on a phone had been awkwardly okay. Could be because it's just too silly that adversaries can't take it seriously, but it's been okay.

Not the parent, but I look at it this way…

Something I have: the database file.

Something I know: the master password to that file.

I figure the sprit of the advice is preserved for the most part. (Doesn’t keep me awake at night, anyway.)

Yes, I was shocked by this too moving phones many years ago. I’m surprised things haven’t improved. I switched to 1Password for this reason; it backs up the 2FA seeds, and I only use it for storing the 2FA seeds, and when I need to use it, I copy-paste the numbers, and I don’t use it for passwords, retaining most of the 2FA factor separation. Switching phones worked (after entering my login, pw, and long master key in the new 1P install).

(My passwords are copy pasted from somewhere else, so admittedly not 2 different factors, but at least 2 independent ones.)

So in short, even though I probably use 1% of the 1P functionality, I can recommend 1P for replacing GA.

Googlers don't use Android

They likely use for one account only, their MS account at work, where it is forced, but not elsewhere because they know it suck.